diff --git a/WORKSPACE b/WORKSPACE
index e4e2d3234e..b8ce674c55 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -45,10 +45,10 @@ container_repositories()
 container_pull(
     name = "debian_hyperkube_base_amd64",
     # 'tag' is also supported, but digest is encouraged for reproducibility.
-    digest = "sha256:fc1b461367730660ac5a40c1eb2d1b23221829acf8a892981c12361383b3742b",
+    digest = "sha256:cc782ed16599000ca4c85d47ec6264753747ae1e77520894dca84b104a7621e2",
     registry = "k8s.gcr.io",
     repository = "debian-hyperkube-base-amd64",
-    tag = "0.8",
+    tag = "0.10",
 )
 
 git_repository(
diff --git a/images/utils-builder/Dockerfile b/images/utils-builder/Dockerfile
index 3bd391030b..6b95ca4b87 100644
--- a/images/utils-builder/Dockerfile
+++ b/images/utils-builder/Dockerfile
@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Sadly we can't update to 0.3 (stretch), because that version FTBFS statically
 FROM k8s.gcr.io/debian-base-amd64:0.2
 
 RUN echo "deb-src http://security.debian.org/ jessie/updates main" >> /etc/apt/sources.list